{"schema_version":"0.10.0","id":"LR-2026-0834","record_version":1,"title":"Suspected AI-assisted agentic ransomware attack on UK school estate (3AM affiliate)","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":53.0,"score_breakdown":{"source_authority":12.1,"independent_corroboration":15.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":4.8,"unhedged_language":4.44},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-04","extraction_run_id":null,"evidence_level":{"level":"confirmed","reason":"2 independent outlets","original_document":null,"reports_total":2,"reports_independent":2,"reports_derivative":0,"developing":true,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-04","history":[{"date":"2026-11-04","from_level":null,"to_level":"confirmed","reason":"2 independent outlets"}]},"sources_hash":"985a35fb2043de7f5c5bb59e252fa8586574457f464a9f199a2ac0c6885e9dc1"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-11-03","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"unknown","summary":"A 3AM ransomware affiliate targeted a UK school estate, reaching nearly 50 machines from an unmanaged host and encrypting around 37 of them. Bitdefender researchers suspected AI-generated commands and an automated agentic loop because repeated commands were slightly modified at each attempt and issued at roughly regular intervals of 40 to 100 seconds. The researchers could not access the attacker's machine, so the language model, its location, and whether a human relayed instructions remain undocumented; only the behaviour, resembling an agentic loop, was observed. The activity spanned September 10 to 19, with initial access undetermined. The actor extracted and decrypted credentials on three Veeam backup servers, copied a Chrome credential database, deployed Mimikatz and LSASS dumping tools, created two backdoor domain administrator accounts, and configured two-way trusts between three Active Directory domains before attempting to disable Sophos and Bitdefender and delete system-state backups.","tags":["ransomware","ai-assisted-cyberattack","agentic-ai","credential-theft","data-exfiltration","education-sector","active-directory"],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":"third_party","adversarial_actor":"external_attacker","input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"major","severity_because":"Major: a live production compromise of a school estate, with about 37 machines encrypted, backups targeted for deletion and endpoint protection removal attempted.","harm_class":["operational","third_party_security","financial","privacy"],"affected_description":"a school estate in the UK; around 37 of nearly 50 machines reached from an unmanaged host were encrypted","protected_class_involved":null,"data_categories_exposed":["credentials","financial"],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.bleepingcomputer.com/news/security/uk-school-estate-hit-by-3am-ransomware-in-suspected-ai-assisted-attack/","publisher":"BleepingComputer","date":"2026-11-03","type":"press","title":"UK school estate hit by 3AM ransomware in suspected AI-assisted attack","archived_url":null,"attachment":"first_report","independence":"independent"},{"url":"https://cybersecuritynews.com/hackers-use-ai-agents-2/","publisher":"CyberSecurityNews","date":"2026-11-03","type":"press","title":"Hackers Use AI Agents to Launch 3AM Ransomware Attacks Against UK School Networks","archived_url":null,"attachment":"fingerprint","independence":"independent"}],"per_field_confidence":{"system.developer":"C","system.autonomy_level":"C","system.deployment_context":"D","event.date_disclosed":"D","event.trigger":"D","event.detection_method":"D","event.summary":"C","event.tags":"C","event.responsible_party":"C","event.adversarial_actor":"C","event.incident_class":"C","impact.severity":"C","impact.harm_class":"C","impact.affected_description":"C","impact.data_categories_exposed":"C","impact.severity_because":"C","context.industry":"C","context.country":"C","context.denominator_available":"D","context.incident_evidence":"C"},"field_citations":{"system.developer":[{"source_index":0,"quote":"\"We were not able to access the machine the attacker worked from, so we cannot document anything about the language model itself: which model it was, whether it ran locally or remotely, or even whether a person was copying and pasting instructions and results between the implant and the model,\" Bitdefender explains."}],"system.autonomy_level":[{"source_index":0,"quote":"The researchers note that they could only document the behavior, and it looked similar to an agentic loop."}],"event.summary":[{"source_index":0,"quote":"A 3AM ransomware affiliate targeted a school estate in the UK and successfully encrypted around 37 of nearly 50 machines reached from an unmanaged host."},{"source_index":0,"quote":"Researchers at cybersecurity company Bitdefender believe the threat actor may have used AI-generated commands and an automated agentic loop to carry out the operation."},{"source_index":0,"quote":"The conclusion is based on a sequence of repeated commands that were slightly modified at each attempt and issued at roughly regular intervals of 40 to 100 seconds."},{"source_index":0,"quote":"\"We were not able to access the machine the attacker worked from, so we cannot document anything about the language model itself: which model it was, whether it ran locally or remotely, or even whether a person was copying and pasting instructions and results between the implant and the model,\" Bitdefender explains."},{"source_index":0,"quote":"The researchers note that they could only document the behavior, and it looked similar to an agentic loop."},{"source_index":0,"quote":"The malicious activity spanned between September 10 and19, but Bitdefender could not establish the attacker’s initial access method."},{"source_index":0,"quote":"The threat actor used a modified public PowerShell tool to extract and decrypt credentials stored on three Veeam backup servers, copied a Chrome database containing credentials, and deployed Mimikatz and LSASS memory-dumping tools."},{"source_index":0,"quote":"They mapped domain relationships and searched logon-script folders for references to other schools, eventually creating two backdoor domain administrator accounts named ‘library’ and ‘svc_bkpmon.’"},{"source_index":0,"quote":"After stealing financial data from compromised machines, the attacker configured two-way trusts between three previously separate Active Directory domains to expand their reach."},{"source_index":0,"quote":"In the final stage of the attack, they attempted to remove Sophos and Bitdefender protection from reachable hosts, delete system-state backups, and deploy 3AM’s Rust-based encryptor."},{"source_index":0,"quote":"They succeeded in about 37 cases."}],"event.tags":[{"source_index":0,"quote":"Researchers at cybersecurity company Bitdefender believe the threat actor may have used AI-generated commands and an automated agentic loop to carry out the operation."},{"source_index":0,"quote":"The threat actor used a modified public PowerShell tool to extract and decrypt credentials stored on three Veeam backup servers, copied a Chrome database containing credentials, and deployed Mimikatz and LSASS memory-dumping tools."},{"source_index":0,"quote":"After stealing financial data from compromised machines, the attacker configured two-way trusts between three previously separate Active Directory domains to expand their reach."},{"source_index":0,"quote":"A 3AM ransomware affiliate targeted a school estate in the UK and successfully encrypted around 37 of nearly 50 machines reached from an unmanaged host."}],"event.responsible_party":[{"source_index":0,"quote":"A 3AM ransomware affiliate targeted a school estate in the UK and successfully encrypted around 37 of nearly 50 machines reached from an unmanaged host."}],"event.adversarial_actor":[{"source_index":0,"quote":"A 3AM ransomware affiliate targeted a school estate in the UK and successfully encrypted around 37 of nearly 50 machines reached from an unmanaged host."}],"event.incident_class":[{"source_index":0,"quote":"A 3AM ransomware affiliate targeted a school estate in the UK and successfully encrypted around 37 of nearly 50 machines reached from an unmanaged host."},{"source_index":0,"quote":"Researchers at cybersecurity company Bitdefender believe the threat actor may have used AI-generated commands and an automated agentic loop to carry out the operation."}],"impact.severity":[{"source_index":0,"quote":"A 3AM ransomware affiliate targeted a school estate in the UK and successfully encrypted around 37 of nearly 50 machines reached from an unmanaged host."},{"source_index":0,"quote":"In the final stage of the attack, they attempted to remove Sophos and Bitdefender protection from reachable hosts, delete system-state backups, and deploy 3AM’s Rust-based encryptor."}],"impact.harm_class":[{"source_index":0,"quote":"They succeeded in about 37 cases."},{"source_index":0,"quote":"After stealing financial data from compromised machines, the attacker configured two-way trusts between three previously separate Active Directory domains to expand their reach."},{"source_index":0,"quote":"The threat actor used a modified public PowerShell tool to extract and decrypt credentials stored on three Veeam backup servers, copied a Chrome database containing credentials, and deployed Mimikatz and LSASS memory-dumping tools."}],"impact.affected_description":[{"source_index":0,"quote":"A 3AM ransomware affiliate targeted a school estate in the UK and successfully encrypted around 37 of nearly 50 machines reached from an unmanaged host."}],"impact.data_categories_exposed":[{"source_index":0,"quote":"The threat actor used a modified public PowerShell tool to extract and decrypt credentials stored on three Veeam backup servers, copied a Chrome database containing credentials, and deployed Mimikatz and LSASS memory-dumping tools."},{"source_index":0,"quote":"After stealing financial data from compromised machines, the attacker configured two-way trusts between three previously separate Active Directory domains to expand their reach."}],"impact.severity_because":[{"source_index":0,"quote":"They succeeded in about 37 cases."},{"source_index":0,"quote":"In the final stage of the attack, they attempted to remove Sophos and Bitdefender protection from reachable hosts, delete system-state backups, and deploy 3AM’s Rust-based encryptor."}],"context.industry":[{"source_index":0,"quote":"A 3AM ransomware affiliate targeted a school estate in the UK and successfully encrypted around 37 of nearly 50 machines reached from an unmanaged host."}],"context.country":[{"source_index":0,"quote":"A 3AM ransomware affiliate targeted a school estate in the UK and successfully encrypted around 37 of nearly 50 machines reached from an unmanaged host."}],"context.incident_evidence":[{"source_index":0,"quote":"\"We were not able to access the machine the attacker worked from, so we cannot document anything about the language model itself: which model it was, whether it ran locally or remotely, or even whether a person was copying and pasting instructions and results between the implant and the model,\" Bitdefender explains."},{"source_index":0,"quote":"The malicious activity spanned between September 10 and19, but Bitdefender could not establish the attacker’s initial access method."},{"source_index":0,"quote":"Researchers at cybersecurity company Bitdefender believe the threat actor may have used AI-generated commands and an automated agentic loop to carry out the operation."}]},"notes_on_gaps":"The document does not name the language model, its developer, version, harness, or whether a human relayed instructions; Bitdefender explicitly says it could not document these. The AI involvement is stated as a belief ('may have used AI-generated commands and an automated agentic loop') based on command timing and slight variation, so agent_involved is left null rather than true, and failure_class is null because no agent mechanism is established. No date of occurrence is given beyond the range September 10 to 19 (year not stated in the text; the article is dated 2026-11-03, but the year of the activity is not stated, so date_occurred is null). No loss figure, record count, detection date, or containment time is stated. The 464,000-patient Kootenai Health figure refers to a separate 2024 incident and is not attributed to this event. The 'unmanaged host' is the stated origin of reach but the initial access method is unknown. Severity is graded major on the live production compromise and ~37 encrypted machines, not on a stated dollar figure. Country GB is inferred from 'a school estate in the UK'; industry from 'school estate'. Extractor proposed values without quotes; dropped: ['context.denominator_available', 'event.date_disclosed', 'event.detection_method', 'event.trigger', 'system.deployment_context']. Single secondary source; corroborate before upgrading any field to B. The article is a threat-intelligence write-up of a criminal intrusion in which an LLM may have assisted the human attackers; the AI is a tool of the adversary, not a deployed system that failed. agent_involved is left null because the source explicitly says it could not prove which model was used or whether a person was pasting results back and forth, so autonomy is not established; failure_class is therefore null. No monetary loss, record count, detection date, containment time or remediation outcome is stated. The 37 encrypted machines and 40 finance files are stated counts but are not third-party person counts, so third_parties_affected_count is null. date_disclosed is the article publication date supplied in metadata, not stated in the text. The article also references other campaigns (JadePuffer, Cursor-driven Aur0ra ransomware) only in passing with no concrete dated event details, so they are not extracted as separate incidents. Severity major rests on the live production compromise of the school estate; no dollar figure is given. Extractor proposed values without quotes; dropped: ['context.denominator_available', 'event.date_disclosed', 'event.detection_method', 'event.trigger', 'system.deployment_context']. Single secondary source; corroborate before upgrading any field to B. [2026-11-04: evidence level set: Confirmed (2 independent outlets)]"},"context":{"industry":"Educational Services","org_size_band":null,"country":"GB","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":{"log_completeness":"Bitdefender could not access the attacker's machine and could not establish initial access","tamper_evidence":null,"timestamp_reliability":"unknown","investigation_independence":"paid_third_party","redaction_summary":null,"analysis_method":"human_review","prompt_output_retention":null},"regulatory":null,"coverage":null}}